Warning: Permanently added '10.128.0.69' (ED25519) to the list of known hosts. [ 101.468494][ T789] cfg80211: failed to load regulatory.db 2026/01/19 17:05:36 parsed 1 programs [ 108.791670][ T5834] cgroup: Unknown subsys name 'net' [ 108.930389][ T5834] cgroup: Unknown subsys name 'cpuset' [ 108.939897][ T5834] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 110.644117][ T5834] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 113.463038][ T5851] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 113.848667][ T3414] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.866427][ T3414] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.144985][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.154514][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.165738][ T5852] chnl_net:caif_netlink_parms(): no params data found [ 114.716354][ T5146] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 114.724920][ T5146] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 114.733792][ T5146] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 114.742116][ T5146] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 114.750749][ T5146] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 114.819111][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.836082][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.843329][ T5852] bridge_slave_0: entered allmulticast mode [ 114.876006][ T5852] bridge_slave_0: entered promiscuous mode [ 114.904537][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.912675][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.926165][ T5852] bridge_slave_1: entered allmulticast mode [ 114.934155][ T5852] bridge_slave_1: entered promiscuous mode [ 115.323113][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.369390][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.499038][ T5852] team0: Port device team_slave_0 added [ 115.538409][ T5852] team0: Port device team_slave_1 added [ 115.867281][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 115.874357][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 115.933440][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 116.006347][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 116.013329][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 116.072423][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 116.725159][ T5852] hsr_slave_0: entered promiscuous mode [ 116.739030][ T5852] hsr_slave_1: entered promiscuous mode [ 117.586817][ T5852] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 117.716241][ T5852] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 117.738617][ T5852] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 117.761897][ T5852] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 117.918606][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.951055][ T5852] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.965213][ T3414] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.972530][ T3414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.990765][ T3486] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.997933][ T3486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.230072][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.504941][ T5852] veth0_vlan: entered promiscuous mode [ 118.519814][ T5852] veth1_vlan: entered promiscuous mode [ 118.553122][ T5852] veth0_macvtap: entered promiscuous mode [ 118.562843][ T5852] veth1_macvtap: entered promiscuous mode [ 118.584602][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.605509][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.620492][ T3414] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.630857][ T3414] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.641639][ T3414] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.651686][ T3414] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2026/01/19 17:05:51 executed programs: 0 [ 118.864770][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 118.873810][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 118.881701][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 118.889881][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 118.898289][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 119.004722][ T5146] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 119.012928][ T5146] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 119.021326][ T5146] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 119.037216][ T5146] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 119.047874][ T5146] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 119.121259][ T5146] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 119.146632][ T5146] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 119.169469][ T5888] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 119.180898][ T5888] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 119.188605][ T5888] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 119.227625][ T5888] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 119.238479][ T5888] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 119.246076][ T5888] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 119.257939][ T5888] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 119.265619][ T5888] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 119.267459][ T5959] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 119.282806][ T5959] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 119.291327][ T5146] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 119.299087][ T5959] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 119.307944][ T5959] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 119.308289][ T5146] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 119.326070][ T5146] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 119.333504][ T5959] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 119.357820][ T5146] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 119.365859][ T5146] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 120.002480][ T3414] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.039841][ T5947] chnl_net:caif_netlink_parms(): no params data found [ 120.274568][ T3414] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.383602][ T5947] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.391460][ T5947] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.398923][ T5947] bridge_slave_0: entered allmulticast mode [ 120.406574][ T5947] bridge_slave_0: entered promiscuous mode [ 120.422862][ T5950] chnl_net:caif_netlink_parms(): no params data found [ 120.479400][ T5947] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.486728][ T5947] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.493917][ T5947] bridge_slave_1: entered allmulticast mode [ 120.503887][ T5947] bridge_slave_1: entered promiscuous mode [ 120.534963][ T3414] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.695076][ T5947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.749705][ T5962] chnl_net:caif_netlink_parms(): no params data found [ 120.798368][ T3414] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.838573][ T5947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 120.981118][ T5954] chnl_net:caif_netlink_parms(): no params data found [ 120.988142][ T5963] Bluetooth: hci0: command tx timeout [ 121.034575][ T5960] chnl_net:caif_netlink_parms(): no params data found [ 121.147028][ T5963] Bluetooth: hci1: command tx timeout [ 121.159849][ T5950] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.176155][ T5950] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.183403][ T5950] bridge_slave_0: entered allmulticast mode [ 121.192529][ T5950] bridge_slave_0: entered promiscuous mode [ 121.211623][ T5947] team0: Port device team_slave_0 added [ 121.226252][ T5963] Bluetooth: hci2: command tx timeout [ 121.270887][ T5950] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.278347][ T5950] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.285496][ T5950] bridge_slave_1: entered allmulticast mode [ 121.293223][ T5950] bridge_slave_1: entered promiscuous mode [ 121.306590][ T5963] Bluetooth: hci3: command tx timeout [ 121.339596][ T5947] team0: Port device team_slave_1 added [ 121.356404][ T5957] chnl_net:caif_netlink_parms(): no params data found [ 121.386049][ T5963] Bluetooth: hci5: command tx timeout [ 121.466134][ T5963] Bluetooth: hci4: command tx timeout [ 121.478350][ T5950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 121.499988][ T5950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 121.624997][ T5947] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 121.632107][ T5947] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.659224][ T5947] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 121.698761][ T5954] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.706030][ T5954] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.713180][ T5954] bridge_slave_0: entered allmulticast mode [ 121.726371][ T5954] bridge_slave_0: entered promiscuous mode [ 121.764336][ T5947] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 121.771534][ T5947] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.798506][ T5947] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 121.809843][ T5962] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.817120][ T5962] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.824286][ T5962] bridge_slave_0: entered allmulticast mode [ 121.831928][ T5962] bridge_slave_0: entered promiscuous mode [ 121.840517][ T5962] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.847792][ T5962] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.855020][ T5962] bridge_slave_1: entered allmulticast mode [ 121.862948][ T5962] bridge_slave_1: entered promiscuous mode [ 121.893362][ T5954] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.901306][ T5954] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.908893][ T5954] bridge_slave_1: entered allmulticast mode [ 121.916665][ T5954] bridge_slave_1: entered promiscuous mode [ 121.932947][ T5960] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.940353][ T5960] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.948110][ T5960] bridge_slave_0: entered allmulticast mode [ 121.955822][ T5960] bridge_slave_0: entered promiscuous mode [ 121.966097][ T5950] team0: Port device team_slave_0 added [ 122.041680][ T5960] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.050423][ T5960] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.058361][ T5960] bridge_slave_1: entered allmulticast mode [ 122.065823][ T5960] bridge_slave_1: entered promiscuous mode [ 122.074908][ T5950] team0: Port device team_slave_1 added [ 122.114871][ T5962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.124608][ T5957] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.131918][ T5957] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.139840][ T5957] bridge_slave_0: entered allmulticast mode [ 122.147835][ T5957] bridge_slave_0: entered promiscuous mode [ 122.248321][ T5962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.257619][ T5957] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.264777][ T5957] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.272422][ T5957] bridge_slave_1: entered allmulticast mode [ 122.280945][ T5957] bridge_slave_1: entered promiscuous mode [ 122.290748][ T5954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.303847][ T5960] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.313687][ T5950] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.321113][ T5950] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.347974][ T5950] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 122.366304][ T5947] hsr_slave_0: entered promiscuous mode [ 122.372778][ T5947] hsr_slave_1: entered promiscuous mode [ 122.379436][ T5947] debugfs: 'hsr0' already exists in 'hsr' [ 122.385206][ T5947] Cannot create hsr debugfs directory [ 122.432916][ T3414] bridge_slave_1: left allmulticast mode [ 122.438994][ T3414] bridge_slave_1: left promiscuous mode [ 122.445596][ T3414] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.458883][ T3414] bridge_slave_0: left allmulticast mode [ 122.464522][ T3414] bridge_slave_0: left promiscuous mode [ 122.470741][ T3414] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.767607][ T3414] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 122.779191][ T3414] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 122.789505][ T3414] bond0 (unregistering): Released all slaves [ 122.873895][ T5954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.885734][ T5960] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.907795][ T5950] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 122.914879][ T5950] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 122.945208][ T5950] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 123.019968][ T5957] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 123.067121][ T5963] Bluetooth: hci0: command tx timeout [ 123.100418][ T5962] team0: Port device team_slave_0 added [ 123.108764][ T5957] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 123.183297][ T5962] team0: Port device team_slave_1 added [ 123.197809][ T3414] hsr_slave_0: left promiscuous mode [ 123.203874][ T3414] hsr_slave_1: left promiscuous mode [ 123.210316][ T3414] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 123.217769][ T3414] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 123.226396][ T5963] Bluetooth: hci1: command tx timeout [ 123.227334][ T3414] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 123.239525][ T3414] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 123.259092][ T3414] veth1_macvtap: left promiscuous mode [ 123.265009][ T3414] veth0_macvtap: left promiscuous mode [ 123.270835][ T3414] veth1_vlan: left promiscuous mode [ 123.276208][ T3414] veth0_vlan: left promiscuous mode [ 123.306028][ T5963] Bluetooth: hci2: command tx timeout [ 123.386549][ T5963] Bluetooth: hci3: command tx timeout [ 123.476285][ T5963] Bluetooth: hci5: command tx timeout [ 123.546065][ T5963] Bluetooth: hci4: command tx timeout [ 123.594855][ T3414] team0 (unregistering): Port device team_slave_1 removed [ 123.619313][ T3414] team0 (unregistering): Port device team_slave_0 removed [ 123.855141][ T5954] team0: Port device team_slave_0 added [ 123.863029][ T5960] team0: Port device team_slave_0 added [ 123.890482][ T5950] hsr_slave_0: entered promiscuous mode [ 123.897225][ T5950] hsr_slave_1: entered promiscuous mode [ 123.938128][ T5954] team0: Port device team_slave_1 added [ 123.945751][ T5960] team0: Port device team_slave_1 added [ 123.993056][ T5957] team0: Port device team_slave_0 added [ 124.059327][ T5962] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.067113][ T5962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.093619][ T5962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.107570][ T5957] team0: Port device team_slave_1 added [ 124.114826][ T5954] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.121884][ T5954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.148129][ T5954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.195120][ T5962] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.202576][ T5962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.229594][ T5962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.279937][ T5954] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.287304][ T5954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.314139][ T5954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.327239][ T5960] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.334182][ T5960] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.360959][ T5960] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.423545][ T5957] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.431779][ T5957] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.458033][ T5957] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.477410][ T5960] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.484365][ T5960] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.510489][ T5960] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.559976][ T5957] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.567369][ T5957] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.593989][ T5957] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.701168][ T5962] hsr_slave_0: entered promiscuous mode [ 124.708845][ T5962] hsr_slave_1: entered promiscuous mode [ 124.715089][ T5962] debugfs: 'hsr0' already exists in 'hsr' [ 124.721446][ T5962] Cannot create hsr debugfs directory [ 124.753249][ T5954] hsr_slave_0: entered promiscuous mode [ 124.759864][ T5954] hsr_slave_1: entered promiscuous mode [ 124.766401][ T5954] debugfs: 'hsr0' already exists in 'hsr' [ 124.772147][ T5954] Cannot create hsr debugfs directory [ 124.952142][ T5960] hsr_slave_0: entered promiscuous mode [ 124.958785][ T5960] hsr_slave_1: entered promiscuous mode [ 124.965122][ T5960] debugfs: 'hsr0' already exists in 'hsr' [ 124.970973][ T5960] Cannot create hsr debugfs directory [ 125.001531][ T5957] hsr_slave_0: entered promiscuous mode [ 125.008374][ T5957] hsr_slave_1: entered promiscuous mode [ 125.014590][ T5957] debugfs: 'hsr0' already exists in 'hsr' [ 125.020626][ T5957] Cannot create hsr debugfs directory [ 125.146179][ T5963] Bluetooth: hci0: command tx timeout [ 125.210842][ T5947] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 125.304189][ T5947] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 125.311117][ T5963] Bluetooth: hci1: command tx timeout [ 125.371516][ T5947] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 125.386164][ T5963] Bluetooth: hci2: command tx timeout [ 125.447402][ T5947] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 125.466013][ T5963] Bluetooth: hci3: command tx timeout [ 125.546075][ T5963] Bluetooth: hci5: command tx timeout [ 125.626364][ T5963] Bluetooth: hci4: command tx timeout [ 125.758959][ T5950] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 125.792162][ T5950] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 125.834769][ T5950] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 125.865306][ T5950] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 126.073595][ T5947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.161297][ T5947] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.193326][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.200520][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.247929][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.255100][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.274362][ T5950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.323844][ T5962] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 126.343530][ T5962] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 126.370673][ T5962] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 126.419688][ T5962] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 126.482133][ T5950] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.545239][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.552439][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.615557][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.622773][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.634800][ T5954] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 126.651766][ T5954] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 126.721680][ T5954] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 126.759477][ T5954] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 126.935704][ T5960] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 127.011232][ T5960] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 127.052077][ T5960] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 127.112146][ T5960] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 127.192530][ T5957] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 127.208465][ T5957] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 127.226621][ T5963] Bluetooth: hci0: command tx timeout [ 127.237551][ T5957] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 127.272857][ T5957] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 127.365870][ T5962] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.397280][ T5963] Bluetooth: hci1: command tx timeout [ 127.425791][ T5947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.466133][ T5963] Bluetooth: hci2: command tx timeout [ 127.519995][ T5962] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.547088][ T5963] Bluetooth: hci3: command tx timeout [ 127.568199][ T994] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.575325][ T994] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.623377][ T5954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.633573][ T994] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.636270][ T5963] Bluetooth: hci5: command tx timeout [ 127.640745][ T994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.681749][ T5950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.707646][ T5963] Bluetooth: hci4: command tx timeout [ 127.738512][ T5947] veth0_vlan: entered promiscuous mode [ 127.751278][ T5960] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.782630][ T5954] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.804527][ T5947] veth1_vlan: entered promiscuous mode [ 127.845681][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.852844][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.869852][ T5960] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.902740][ T994] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.909904][ T994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.937508][ T3414] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.944645][ T3414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.968796][ T5950] veth0_vlan: entered promiscuous mode [ 127.979362][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.986548][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.024209][ T5950] veth1_vlan: entered promiscuous mode [ 128.087947][ T5947] veth0_macvtap: entered promiscuous mode [ 128.113834][ T5957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.143538][ T5947] veth1_macvtap: entered promiscuous mode [ 128.258095][ T5957] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.281017][ T5947] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.320452][ T3414] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.327709][ T3414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.365624][ T5950] veth0_macvtap: entered promiscuous mode [ 128.398463][ T5947] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.427871][ T3414] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.435052][ T3414] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.479712][ T5950] veth1_macvtap: entered promiscuous mode [ 128.522565][ T2964] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.534882][ T2964] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.570581][ T2964] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.609818][ T2964] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.645841][ T5962] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.685375][ T5950] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.749532][ T5950] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.835223][ T37] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.853906][ T5954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.870973][ T37] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.896584][ T1133] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.911287][ T37] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.923231][ T1133] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.959981][ T37] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.983248][ T5960] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.084271][ T3414] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.114630][ T3414] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/01/19 17:06:01 executed programs: 12 [ 129.276324][ T5954] veth0_vlan: entered promiscuous mode [ 129.283651][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.308863][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.417468][ T5954] veth1_vlan: entered promiscuous mode [ 129.473213][ T3414] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.489982][ T3414] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.676904][ T5957] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.684336][ T5962] veth0_vlan: entered promiscuous mode [ 129.709612][ T5954] veth0_macvtap: entered promiscuous mode [ 129.742266][ T5954] veth1_macvtap: entered promiscuous mode [ 129.817698][ T5962] veth1_vlan: entered promiscuous mode [ 129.908969][ T5954] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 129.951748][ T5954] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 130.029426][ T994] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.058368][ T994] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.077660][ T6101] loop0: detected capacity change from 0 to 32768 [ 130.077830][ T994] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.150923][ T994] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.152552][ T6101] [ 130.152552][ T6101] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 130.152552][ T6101] [ 130.191188][ T31] audit: type=1800 audit(1768842362.745:2): pid=6101 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 130.206847][ T5957] veth0_vlan: entered promiscuous mode [ 130.253054][ T5962] veth0_macvtap: entered promiscuous mode [ 130.306299][ T5962] veth1_macvtap: entered promiscuous mode [ 130.374634][ T5957] veth1_vlan: entered promiscuous mode [ 130.397579][ T5960] veth0_vlan: entered promiscuous mode [ 130.404655][ T6106] loop2: detected capacity change from 0 to 32768 [ 130.445637][ T5962] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 130.474198][ T6106] [ 130.474198][ T6106] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 130.474198][ T6106] [ 130.528417][ T5962] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 130.552044][ T31] audit: type=1800 audit(1768842363.105:3): pid=6106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.19" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 130.555777][ T5960] veth1_vlan: entered promiscuous mode [ 130.665563][ T4367] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.687117][ T994] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.705680][ T994] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.749465][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.764498][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.785465][ T994] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.883428][ T5957] veth0_macvtap: entered promiscuous mode [ 130.965580][ T5957] veth1_macvtap: entered promiscuous mode [ 131.018887][ T5960] veth0_macvtap: entered promiscuous mode [ 131.032706][ T4367] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.051884][ T4367] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.089877][ T5960] veth1_macvtap: entered promiscuous mode [ 131.159263][ T5957] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 131.195825][ T2964] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.228948][ T2964] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.254406][ T5957] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 131.330972][ T5960] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 131.381210][ T4367] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.421493][ T4367] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.435108][ T5960] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 131.462959][ T4367] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.463472][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.502876][ T4367] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.510397][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.560088][ T994] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.600418][ T994] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.618415][ T994] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.662196][ T994] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.827182][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.880489][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 132.016766][ T1012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 132.043240][ T1012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 132.155029][ T3464] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 132.193437][ T3464] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 132.302640][ T6110] loop3: detected capacity change from 0 to 32768 [ 132.331852][ T3464] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 132.345192][ T60] [ 132.345192][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.345192][ T60] [ 132.350020][ T3464] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 132.414266][ T6110] [ 132.414266][ T6110] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.414266][ T6110] [ 132.417550][ T60] [ 132.417550][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.417550][ T60] [ 132.482295][ T31] audit: type=1800 audit(1768842365.035:4): pid=6110 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.20" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 132.513988][ T60] [ 132.513988][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.513988][ T60] [ 132.581848][ T5947] [ 132.581848][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.581848][ T5947] [ 132.648130][ T114] [ 132.648130][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.648130][ T114] [ 132.708310][ T5947] [ 132.708310][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.708310][ T5947] [ 132.719826][ T3486] [ 132.719826][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.719826][ T3486] [ 132.794627][ T3486] [ 132.794627][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.794627][ T3486] [ 132.845019][ T3486] [ 132.845019][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.845019][ T3486] [ 132.874912][ T5950] [ 132.874912][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.874912][ T5950] [ 132.920694][ T114] [ 132.920694][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.920694][ T114] [ 132.975226][ T5950] [ 132.975226][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.975226][ T5950] [ 133.242666][ T6111] loop5: detected capacity change from 0 to 32768 [ 133.294228][ T6111] [ 133.294228][ T6111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 133.294228][ T6111] [ 133.335379][ T31] audit: type=1800 audit(1768842365.885:5): pid=6111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.22" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 134.092584][ T6112] loop1: detected capacity change from 0 to 32768 [ 134.165157][ T6112] [ 134.165157][ T6112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.165157][ T6112] 2026/01/19 17:06:06 executed programs: 20 [ 134.226133][ T31] audit: type=1800 audit(1768842366.775:6): pid=6112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.18" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 134.259238][ T12] [ 134.259238][ T12] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.259238][ T12] [ 134.313965][ T12] [ 134.313965][ T12] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.313965][ T12] [ 134.368956][ T12] [ 134.368956][ T12] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.368956][ T12] [ 134.424535][ T5954] [ 134.424535][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.424535][ T5954] [ 134.477034][ T114] [ 134.477034][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.477034][ T114] [ 134.493049][ T6114] loop4: detected capacity change from 0 to 32768 [ 134.530531][ T5954] [ 134.530531][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.530531][ T5954] [ 134.599406][ T6114] [ 134.599406][ T6114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.599406][ T6114] [ 134.686160][ T31] audit: type=1800 audit(1768842367.235:7): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.21" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 134.841345][ T6113] [ 134.841345][ T6113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.841345][ T6113] [ 134.890802][ T6113] [ 134.890802][ T6113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.890802][ T6113] [ 134.946062][ T6113] [ 134.946062][ T6113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.946062][ T6113] [ 134.992175][ T5962] [ 134.992175][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.992175][ T5962] [ 135.035517][ T114] [ 135.035517][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.035517][ T114] [ 135.086027][ T5962] [ 135.086027][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.086027][ T5962] [ 135.327522][ T4367] [ 135.327522][ T4367] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.327522][ T4367] [ 135.347146][ T6116] loop0: detected capacity change from 0 to 32768 [ 135.375704][ T4367] [ 135.375704][ T4367] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.375704][ T4367] [ 135.416481][ T4367] [ 135.416481][ T4367] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.416481][ T4367] [ 135.418402][ T6116] [ 135.418402][ T6116] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.418402][ T6116] [ 135.476948][ T113] [ 135.476948][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.476948][ T113] [ 135.508228][ T31] audit: type=1800 audit(1768842368.065:8): pid=6116 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.23" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 135.530103][ T5957] [ 135.530103][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.530103][ T5957] [ 135.562440][ T5957] [ 135.562440][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.562440][ T5957] [ 135.605177][ T6117] loop2: detected capacity change from 0 to 32768 [ 135.706707][ T6117] [ 135.706707][ T6117] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.706707][ T6117] [ 135.752957][ T31] audit: type=1800 audit(1768842368.305:9): pid=6117 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.24" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 135.891647][ T4367] [ 135.891647][ T4367] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.891647][ T4367] [ 135.944957][ T4367] [ 135.944957][ T4367] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.944957][ T4367] [ 136.002108][ T4367] [ 136.002108][ T4367] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.002108][ T4367] [ 136.046337][ T5960] [ 136.046337][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.046337][ T5960] [ 136.089183][ T113] [ 136.089183][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.089183][ T113] [ 136.136658][ T5960] [ 136.136658][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.136658][ T5960] [ 136.636447][ T994] [ 136.636447][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.636447][ T994] [ 136.680651][ T994] [ 136.680651][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.680651][ T994] [ 136.720408][ T994] [ 136.720408][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.720408][ T994] [ 136.759217][ T113] [ 136.759217][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.759217][ T113] [ 136.799388][ T6120] loop3: detected capacity change from 0 to 32768 [ 136.801509][ T5947] [ 136.801509][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.801509][ T5947] [ 136.836997][ T5947] [ 136.836997][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.836997][ T5947] [ 136.859805][ T6120] [ 136.859805][ T6120] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.859805][ T6120] [ 136.953546][ T68] [ 136.953546][ T68] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.953546][ T68] [ 136.964666][ T31] audit: type=1800 audit(1768842369.505:10): pid=6120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.25" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 137.027270][ T68] [ 137.027270][ T68] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.027270][ T68] [ 137.096463][ T68] [ 137.096463][ T68] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.096463][ T68] [ 137.144728][ T5950] [ 137.144728][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.144728][ T5950] [ 137.186287][ T113] [ 137.186287][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.186287][ T113] [ 137.237355][ T5950] [ 137.237355][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.237355][ T5950] [ 137.402393][ T6123] loop5: detected capacity change from 0 to 32768 [ 137.461073][ T6123] [ 137.461073][ T6123] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.461073][ T6123] [ 137.543153][ T31] audit: type=1800 audit(1768842370.085:11): pid=6123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.26" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 137.944184][ T6125] loop1: detected capacity change from 0 to 32768 [ 138.040507][ T6125] [ 138.040507][ T6125] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.040507][ T6125] [ 138.121338][ T31] audit: type=1800 audit(1768842370.665:12): pid=6125 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.27" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 138.184624][ T6127] loop4: detected capacity change from 0 to 32768 [ 138.244201][ T6127] [ 138.244201][ T6127] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.244201][ T6127] [ 138.308311][ T31] audit: type=1800 audit(1768842370.865:13): pid=6127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.28" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 138.367622][ T6113] [ 138.367622][ T6113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.367622][ T6113] [ 138.434198][ T6113] [ 138.434198][ T6113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.434198][ T6113] [ 138.460081][ T6113] [ 138.460081][ T6113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.460081][ T6113] [ 138.521652][ T5954] [ 138.521652][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.521652][ T5954] [ 138.569863][ T114] [ 138.569863][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.569863][ T114] [ 138.658821][ T5954] [ 138.658821][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.658821][ T5954] [ 138.968415][ T3486] [ 138.968415][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.968415][ T3486] [ 139.024159][ T3486] [ 139.024159][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.024159][ T3486] [ 139.066311][ T3486] [ 139.066311][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.066311][ T3486] [ 139.096666][ T5962] [ 139.096666][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.096666][ T5962] [ 139.137930][ T114] [ 139.137930][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.137930][ T114] [ 139.170668][ T5962] [ 139.170668][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.170668][ T5962] [ 139.207260][ T6130] loop0: detected capacity change from 0 to 32768 [ 139.268489][ T6130] [ 139.268489][ T6130] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.268489][ T6130] [ 139.368429][ T31] audit: type=1800 audit(1768842371.925:14): pid=6130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.29" name="file1" dev="loop0" ino=4 res=0 errno=0 2026/01/19 17:06:12 executed programs: 28 [ 139.469062][ T2964] [ 139.469062][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.469062][ T2964] [ 139.515972][ T2964] [ 139.515972][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.515972][ T2964] [ 139.578159][ T2964] [ 139.578159][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.578159][ T2964] [ 139.609335][ T113] [ 139.609335][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.609335][ T113] [ 139.650485][ T5957] [ 139.650485][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.650485][ T5957] [ 139.659467][ T6131] loop2: detected capacity change from 0 to 32768 [ 139.686557][ T5957] [ 139.686557][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.686557][ T5957] [ 139.745374][ T6131] [ 139.745374][ T6131] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.745374][ T6131] [ 139.817328][ T994] [ 139.817328][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.817328][ T994] [ 139.828671][ T31] audit: type=1800 audit(1768842372.385:15): pid=6131 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.30" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 139.926466][ T994] [ 139.926466][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.926466][ T994] [ 139.978222][ T994] [ 139.978222][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.978222][ T994] [ 140.041262][ T113] [ 140.041262][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.041262][ T113] [ 140.086161][ T5960] [ 140.086161][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.086161][ T5960] [ 140.112551][ T5960] [ 140.112551][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.112551][ T5960] [ 140.716438][ T37] [ 140.716438][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.716438][ T37] [ 140.746363][ T37] [ 140.746363][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.746363][ T37] [ 140.774691][ T37] [ 140.774691][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.774691][ T37] [ 140.822496][ T113] [ 140.822496][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.822496][ T113] [ 140.853532][ T5947] [ 140.853532][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.853532][ T5947] [ 140.880057][ T5947] [ 140.880057][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.880057][ T5947] [ 140.927622][ T6132] loop3: detected capacity change from 0 to 32768 [ 140.982298][ T6132] [ 140.982298][ T6132] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.982298][ T6132] [ 141.041074][ T37] [ 141.041074][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.041074][ T37] [ 141.071853][ T31] audit: type=1800 audit(1768842373.625:16): pid=6132 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.31" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 141.088606][ T37] [ 141.088606][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.088606][ T37] [ 141.181986][ T37] [ 141.181986][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.181986][ T37] [ 141.246084][ T113] [ 141.246084][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.246084][ T113] [ 141.291937][ T5950] [ 141.291937][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.291937][ T5950] [ 141.329287][ T5950] [ 141.329287][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.329287][ T5950] [ 141.474613][ T6133] loop5: detected capacity change from 0 to 32768 [ 141.564366][ T6133] [ 141.564366][ T6133] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.564366][ T6133] [ 141.646858][ T31] audit: type=1800 audit(1768842374.205:17): pid=6133 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.32" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 141.731547][ T6134] loop1: detected capacity change from 0 to 32768 [ 141.809571][ T6134] [ 141.809571][ T6134] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.809571][ T6134] [ 141.875675][ T31] audit: type=1800 audit(1768842374.425:18): pid=6134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.33" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 142.305066][ T6135] loop4: detected capacity change from 0 to 32768 [ 142.357546][ T6135] [ 142.357546][ T6135] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.357546][ T6135] [ 142.411899][ T31] audit: type=1800 audit(1768842374.965:19): pid=6135 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.34" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 142.437000][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 142.437130][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 142.499896][ T1133] [ 142.499896][ T1133] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.499896][ T1133] [ 142.517049][ T1133] [ 142.517049][ T1133] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.517049][ T1133] [ 142.527994][ T1133] [ 142.527994][ T1133] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.527994][ T1133] [ 142.541227][ T113] [ 142.541227][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.541227][ T113] [ 142.586789][ T5954] [ 142.586789][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.586789][ T5954] [ 142.621281][ T5954] [ 142.621281][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.621281][ T5954] [ 143.035666][ T50] [ 143.035666][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.035666][ T50] [ 143.077544][ T50] [ 143.077544][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.077544][ T50] [ 143.131526][ T50] [ 143.131526][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.131526][ T50] [ 143.158120][ T6136] loop0: detected capacity change from 0 to 32768 [ 143.166353][ T5962] [ 143.166353][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.166353][ T5962] [ 143.213073][ T6136] [ 143.213073][ T6136] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.213073][ T6136] [ 143.216303][ T113] [ 143.216303][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.216303][ T113] [ 143.269401][ T5962] [ 143.269401][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.269401][ T5962] [ 143.312700][ T31] audit: type=1800 audit(1768842375.865:20): pid=6136 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.35" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 143.408116][ T6137] loop2: detected capacity change from 0 to 32768 [ 143.476926][ T12] [ 143.476926][ T12] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.476926][ T12] [ 143.531518][ T6137] [ 143.531518][ T6137] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.531518][ T6137] [ 143.536057][ T12] [ 143.536057][ T12] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.536057][ T12] [ 143.591891][ T31] audit: type=1800 audit(1768842376.145:21): pid=6137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.36" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 143.604630][ T12] [ 143.604630][ T12] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.604630][ T12] [ 143.678253][ T113] [ 143.678253][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.678253][ T113] [ 143.734752][ T5957] [ 143.734752][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.734752][ T5957] [ 143.763093][ T5957] [ 143.763093][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.763093][ T5957] [ 143.775234][ T13] [ 143.775234][ T13] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.775234][ T13] [ 143.813036][ T13] [ 143.813036][ T13] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.813036][ T13] [ 143.874430][ T13] [ 143.874430][ T13] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.874430][ T13] [ 143.929174][ T113] [ 143.929174][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.929174][ T113] [ 143.991496][ T5960] [ 143.991496][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.991496][ T5960] [ 144.047581][ T5960] [ 144.047581][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.047581][ T5960] 2026/01/19 17:06:17 executed programs: 36 [ 144.664240][ T60] [ 144.664240][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.664240][ T60] [ 144.684861][ T6138] loop3: detected capacity change from 0 to 32768 [ 144.700424][ T60] [ 144.700424][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.700424][ T60] [ 144.731723][ T60] [ 144.731723][ T60] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.731723][ T60] [ 144.767296][ T6138] [ 144.767296][ T6138] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.767296][ T6138] [ 144.776987][ T114] [ 144.776987][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.776987][ T114] [ 144.797973][ T5947] [ 144.797973][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.797973][ T5947] [ 144.817253][ T5947] [ 144.817253][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.817253][ T5947] [ 144.840263][ T31] audit: type=1800 audit(1768842377.395:22): pid=6138 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.37" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 145.080097][ T1012] [ 145.080097][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.080097][ T1012] [ 145.128298][ T1012] [ 145.128298][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.128298][ T1012] [ 145.177499][ T1012] [ 145.177499][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.177499][ T1012] [ 145.209901][ T114] [ 145.209901][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.209901][ T114] [ 145.251186][ T5950] [ 145.251186][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.251186][ T5950] [ 145.266242][ T5950] [ 145.266242][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.266242][ T5950] [ 145.501815][ T6139] loop5: detected capacity change from 0 to 32768 [ 145.580431][ T6139] [ 145.580431][ T6139] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 145.580431][ T6139] [ 145.669632][ T31] audit: type=1800 audit(1768842378.215:23): pid=6139 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.38" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 145.974949][ T6140] loop1: detected capacity change from 0 to 32768 [ 146.040290][ T6140] [ 146.040290][ T6140] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.040290][ T6140] [ 146.084861][ T31] audit: type=1800 audit(1768842378.635:24): pid=6140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.39" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 146.197889][ T6141] loop4: detected capacity change from 0 to 32768 [ 146.262076][ T6141] [ 146.262076][ T6141] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.262076][ T6141] [ 146.303806][ T6142] [ 146.303806][ T6142] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.303806][ T6142] [ 146.357682][ T31] audit: type=1800 audit(1768842378.895:25): pid=6141 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.40" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 146.365975][ T6142] [ 146.365975][ T6142] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.365975][ T6142] [ 146.489054][ T6142] [ 146.489054][ T6142] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.489054][ T6142] [ 146.557227][ T5954] [ 146.557227][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.557227][ T5954] [ 146.618498][ T114] [ 146.618498][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.618498][ T114] [ 146.669625][ T5954] [ 146.669625][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.669625][ T5954] [ 146.854804][ T6143] loop0: detected capacity change from 0 to 32768 [ 146.923931][ T6143] [ 146.923931][ T6143] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 146.923931][ T6143] [ 146.997554][ T31] audit: type=1800 audit(1768842379.555:26): pid=6143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.41" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 147.182270][ T3955] [ 147.182270][ T3955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.182270][ T3955] [ 147.226879][ T3955] [ 147.226879][ T3955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.226879][ T3955] [ 147.272467][ T3955] [ 147.272467][ T3955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.272467][ T3955] [ 147.333255][ T114] [ 147.333255][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.333255][ T114] [ 147.379574][ T5962] [ 147.379574][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.379574][ T5962] [ 147.415293][ T5962] [ 147.415293][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.415293][ T5962] [ 147.573069][ T6144] loop2: detected capacity change from 0 to 32768 [ 147.616991][ T6145] [ 147.616991][ T6145] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.616991][ T6145] [ 147.637123][ T6144] [ 147.637123][ T6144] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.637123][ T6144] [ 147.666542][ T6145] [ 147.666542][ T6145] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.666542][ T6145] [ 147.704961][ T31] audit: type=1800 audit(1768842380.255:27): pid=6144 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.42" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 147.736498][ T6145] [ 147.736498][ T6145] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.736498][ T6145] [ 147.739267][ T3414] [ 147.739267][ T3414] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.739267][ T3414] [ 147.785230][ T5957] [ 147.785230][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.785230][ T5957] [ 147.809519][ T3414] [ 147.809519][ T3414] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.809519][ T3414] [ 147.820947][ T114] [ 147.820947][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.820947][ T114] [ 147.853405][ T5957] [ 147.853405][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.853405][ T5957] [ 147.858862][ T3414] [ 147.858862][ T3414] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.858862][ T3414] [ 147.918312][ T113] [ 147.918312][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.918312][ T113] [ 147.962554][ T5960] [ 147.962554][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 147.962554][ T5960] [ 148.024490][ T5960] [ 148.024490][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.024490][ T5960] [ 148.527434][ T68] [ 148.527434][ T68] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.527434][ T68] [ 148.573342][ T68] [ 148.573342][ T68] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.573342][ T68] [ 148.604778][ T68] [ 148.604778][ T68] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.604778][ T68] [ 148.655967][ T5947] [ 148.655967][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.655967][ T5947] [ 148.696210][ T114] [ 148.696210][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.696210][ T114] [ 148.736104][ T5947] [ 148.736104][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.736104][ T5947] [ 148.787394][ T6146] loop3: detected capacity change from 0 to 32768 [ 148.840671][ T6146] [ 148.840671][ T6146] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.840671][ T6146] [ 148.940817][ T31] audit: type=1800 audit(1768842381.495:28): pid=6146 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.43" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 148.989700][ T3955] [ 148.989700][ T3955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 148.989700][ T3955] [ 149.044579][ T3955] [ 149.044579][ T3955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.044579][ T3955] [ 149.099227][ T3955] [ 149.099227][ T3955] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.099227][ T3955] [ 149.141256][ T113] [ 149.141256][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.141256][ T113] [ 149.172750][ T5950] [ 149.172750][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.172750][ T5950] [ 149.204808][ T5950] [ 149.204808][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.204808][ T5950] [ 149.660197][ T6147] loop5: detected capacity change from 0 to 32768 [ 149.717127][ T6147] [ 149.717127][ T6147] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.717127][ T6147] [ 149.763493][ T31] audit: type=1800 audit(1768842382.315:29): pid=6147 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.44" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 149.812155][ T6148] loop1: detected capacity change from 0 to 32768 [ 149.887999][ T6148] [ 149.887999][ T6148] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 149.887999][ T6148] [ 149.958794][ T31] audit: type=1800 audit(1768842382.505:30): pid=6148 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.45" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 150.101827][ T6149] loop4: detected capacity change from 0 to 32768 [ 150.204146][ T6149] [ 150.204146][ T6149] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.204146][ T6149] [ 150.278144][ T31] audit: type=1800 audit(1768842382.835:31): pid=6149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.46" name="file1" dev="loop4" ino=4 res=0 errno=0 2026/01/19 17:06:23 executed programs: 44 [ 150.456423][ T1012] [ 150.456423][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.456423][ T1012] [ 150.496565][ T1012] [ 150.496565][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.496565][ T1012] [ 150.534811][ T1012] [ 150.534811][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.534811][ T1012] [ 150.578076][ T113] [ 150.578076][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.578076][ T113] [ 150.612205][ T5954] [ 150.612205][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.612205][ T5954] [ 150.637844][ T5954] [ 150.637844][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 150.637844][ T5954] [ 151.038083][ T6150] loop0: detected capacity change from 0 to 32768 [ 151.086434][ T6150] [ 151.086434][ T6150] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.086434][ T6150] [ 151.135628][ T31] audit: type=1800 audit(1768842383.685:32): pid=6150 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.47" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 151.298940][ T994] [ 151.298940][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.298940][ T994] [ 151.338833][ T994] [ 151.338833][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.338833][ T994] [ 151.382013][ T994] [ 151.382013][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.382013][ T994] [ 151.418781][ T114] [ 151.418781][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.418781][ T114] [ 151.442558][ T5962] [ 151.442558][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.442558][ T5962] [ 151.470878][ T5962] [ 151.470878][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.470878][ T5962] [ 151.594475][ T6128] [ 151.594475][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.594475][ T6128] [ 151.600450][ T6151] loop2: detected capacity change from 0 to 32768 [ 151.648456][ T6128] [ 151.648456][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.648456][ T6128] [ 151.689295][ T6151] [ 151.689295][ T6151] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.689295][ T6151] [ 151.703394][ T6128] [ 151.703394][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.703394][ T6128] [ 151.740088][ T1012] [ 151.740088][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.740088][ T1012] [ 151.774061][ T31] audit: type=1800 audit(1768842384.315:33): pid=6151 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.48" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 151.801553][ T5957] [ 151.801553][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.801553][ T5957] [ 151.806447][ T1012] [ 151.806447][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.806447][ T1012] [ 151.856721][ T1012] [ 151.856721][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.856721][ T1012] [ 151.860134][ T114] [ 151.860134][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.860134][ T114] [ 151.892303][ T113] [ 151.892303][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.892303][ T113] [ 151.913985][ T5960] [ 151.913985][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.913985][ T5960] [ 151.936482][ T5957] [ 151.936482][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.936482][ T5957] [ 151.955518][ T5960] [ 151.955518][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 151.955518][ T5960] [ 152.566638][ T50] [ 152.566638][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.566638][ T50] [ 152.593730][ T50] [ 152.593730][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.593730][ T50] [ 152.617994][ T50] [ 152.617994][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.617994][ T50] [ 152.653784][ T114] [ 152.653784][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.653784][ T114] [ 152.689263][ T5947] [ 152.689263][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.689263][ T5947] [ 152.726362][ T5947] [ 152.726362][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.726362][ T5947] [ 152.782752][ T6153] loop3: detected capacity change from 0 to 32768 [ 152.828151][ T6153] [ 152.828151][ T6153] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 152.828151][ T6153] [ 152.881685][ T31] audit: type=1800 audit(1768842385.435:34): pid=6153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.49" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 153.095375][ T2964] [ 153.095375][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.095375][ T2964] [ 153.166059][ T2964] [ 153.166059][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.166059][ T2964] [ 153.204620][ T2964] [ 153.204620][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.204620][ T2964] [ 153.271256][ T5950] [ 153.271256][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.271256][ T5950] [ 153.346526][ T113] [ 153.346526][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.346526][ T113] [ 153.377562][ T5950] [ 153.377562][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.377562][ T5950] [ 153.583487][ T6154] loop5: detected capacity change from 0 to 32768 [ 153.631771][ T6154] [ 153.631771][ T6154] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.631771][ T6154] [ 153.682567][ T31] audit: type=1800 audit(1768842386.235:35): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.50" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 153.956992][ T6155] loop4: detected capacity change from 0 to 32768 [ 153.998404][ T6155] [ 153.998404][ T6155] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 153.998404][ T6155] [ 154.096329][ T31] audit: type=1800 audit(1768842386.645:36): pid=6155 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.52" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 154.107267][ T6156] loop1: detected capacity change from 0 to 32768 [ 154.221509][ T6156] [ 154.221509][ T6156] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.221509][ T6156] [ 154.260104][ T31] audit: type=1800 audit(1768842386.815:37): pid=6156 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.51" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 154.402737][ T1012] [ 154.402737][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.402737][ T1012] [ 154.458198][ T1012] [ 154.458198][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.458198][ T1012] [ 154.509724][ T1012] [ 154.509724][ T1012] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.509724][ T1012] [ 154.567447][ T114] [ 154.567447][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.567447][ T114] [ 154.627462][ T5954] [ 154.627462][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.627462][ T5954] [ 154.674969][ T5954] [ 154.674969][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 154.674969][ T5954] [ 154.980874][ T6157] loop0: detected capacity change from 0 to 32768 [ 155.006491][ T6157] [ 155.006491][ T6157] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.006491][ T6157] [ 155.064291][ T31] audit: type=1800 audit(1768842387.615:38): pid=6157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.53" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 155.300804][ T994] [ 155.300804][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.300804][ T994] [ 155.332351][ T994] [ 155.332351][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.332351][ T994] [ 155.361679][ T994] [ 155.361679][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.361679][ T994] [ 155.400119][ T6158] loop2: detected capacity change from 0 to 32768 [ 155.413702][ T114] [ 155.413702][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.413702][ T114] [ 155.448840][ T6158] [ 155.448840][ T6158] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.448840][ T6158] [ 155.455250][ T5962] [ 155.455250][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.455250][ T5962] [ 155.495084][ T31] audit: type=1800 audit(1768842388.045:39): pid=6158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.54" name="file1" dev="loop2" ino=4 res=0 errno=0 [ 155.539119][ T5962] [ 155.539119][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.539119][ T5962] 2026/01/19 17:06:28 executed programs: 52 [ 155.615161][ T37] [ 155.615161][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.615161][ T37] [ 155.641458][ T37] [ 155.641458][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.641458][ T37] [ 155.696366][ T37] [ 155.696366][ T37] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.696366][ T37] [ 155.700004][ T6128] [ 155.700004][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.700004][ T6128] [ 155.726600][ T5960] [ 155.726600][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.726600][ T5960] [ 155.776708][ T113] [ 155.776708][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.776708][ T113] [ 155.796172][ T6128] [ 155.796172][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.796172][ T6128] [ 155.822534][ T5960] [ 155.822534][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.822534][ T5960] [ 155.843488][ T6128] [ 155.843488][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.843488][ T6128] [ 155.920680][ T5957] [ 155.920680][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.920680][ T5957] [ 155.976234][ T113] [ 155.976234][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 155.976234][ T113] [ 156.028401][ T5957] [ 156.028401][ T5957] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.028401][ T5957] [ 156.371115][ T3486] [ 156.371115][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.371115][ T3486] [ 156.404351][ T3486] [ 156.404351][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.404351][ T3486] [ 156.438441][ T3486] [ 156.438441][ T3486] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.438441][ T3486] [ 156.470234][ T113] [ 156.470234][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.470234][ T113] [ 156.496135][ T5947] [ 156.496135][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.496135][ T5947] [ 156.519975][ T5947] [ 156.519975][ T5947] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.519975][ T5947] [ 156.852590][ T6159] loop3: detected capacity change from 0 to 32768 [ 156.918617][ T6159] [ 156.918617][ T6159] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 156.918617][ T6159] [ 156.971880][ T31] audit: type=1800 audit(1768842389.525:40): pid=6159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.55" name="file1" dev="loop3" ino=4 res=0 errno=0 [ 157.168636][ T2964] [ 157.168636][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.168636][ T2964] [ 157.219104][ T2964] [ 157.219104][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.219104][ T2964] [ 157.262627][ T2964] [ 157.262627][ T2964] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.262627][ T2964] [ 157.306641][ T5950] [ 157.306641][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.306641][ T5950] [ 157.336306][ T113] [ 157.336306][ T113] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.336306][ T113] [ 157.376025][ T5950] [ 157.376025][ T5950] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.376025][ T5950] [ 157.601990][ T6160] loop5: detected capacity change from 0 to 32768 [ 157.672699][ T6160] [ 157.672699][ T6160] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 157.672699][ T6160] [ 157.731824][ T31] audit: type=1800 audit(1768842390.285:41): pid=6160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.56" name="file1" dev="loop5" ino=4 res=0 errno=0 [ 157.952575][ T6161] loop4: detected capacity change from 0 to 32768 [ 157.986409][ T6162] loop1: detected capacity change from 0 to 32768 [ 158.031003][ T6161] [ 158.031003][ T6161] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.031003][ T6161] [ 158.045812][ T6162] [ 158.045812][ T6162] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.045812][ T6162] [ 158.102904][ T31] audit: type=1800 audit(1768842390.655:42): pid=6161 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.57" name="file1" dev="loop4" ino=4 res=0 errno=0 [ 158.233361][ T31] audit: type=1800 audit(1768842390.695:43): pid=6162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.58" name="file1" dev="loop1" ino=4 res=0 errno=0 [ 158.412120][ T994] [ 158.412120][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.412120][ T994] [ 158.471475][ T994] [ 158.471475][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.471475][ T994] [ 158.536332][ T994] [ 158.536332][ T994] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.536332][ T994] [ 158.598562][ T5954] [ 158.598562][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.598562][ T5954] [ 158.647786][ T114] [ 158.647786][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.647786][ T114] [ 158.717399][ T5954] [ 158.717399][ T5954] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.717399][ T5954] [ 158.769986][ T6163] loop0: detected capacity change from 0 to 32768 [ 158.861353][ T6163] [ 158.861353][ T6163] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 158.861353][ T6163] [ 158.937056][ T31] audit: type=1800 audit(1768842391.495:44): pid=6163 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.59" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 159.402857][ T6128] [ 159.402857][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.402857][ T6128] [ 159.448025][ T6128] [ 159.448025][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.448025][ T6128] [ 159.496315][ T6128] [ 159.496315][ T6128] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.496315][ T6128] [ 159.560052][ T5962] [ 159.560052][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.560052][ T5962] [ 159.576692][ T114] [ 159.576692][ T114] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.576692][ T114] [ 159.618900][ T5962] [ 159.618900][ T5962] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.618900][ T5962] [ 159.631417][ T3464] [ 159.631417][ T3464] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.631417][ T3464] [ 159.662875][ T3464] [ 159.662875][ T3464] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.662875][ T3464] [ 159.730271][ T3464] [ 159.730271][ T3464] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.730271][ T3464] [ 159.772410][ T50] [ 159.772410][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.772410][ T50] [ 159.786471][ T5960] [ 159.786471][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.786471][ T5960] [ 159.821655][ T5960] [ 159.821655][ T5960] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.821655][ T5960] [ 159.842606][ T50] [ 159.842606][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.842606][ T50] [ 159.880714][ T114] ================================================================== [ 159.884265][ T50] [ 159.884265][ T50] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 159.884265][ T50] [ 159.888823][ T114] BUG: KASAN: slab-use-after-free in __mutex_lock+0x1a24/0x1ca0 [ 159.888876][ T114] Read of size 8 at addr ffff888033e0b908 by task jfsCommit/114 [ 159.888910][ T114] [ 159.888927][ T114] CPU: 0 UID: 0 PID: 114 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) [ 159.888972][ T114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 159.888996][ T114] Call Trace: [ 159.889009][ T114] [ 159.889035][ T114] dump_stack_lvl+0x116/0x1f0 [ 159.889075][ T114] print_report+0xcd/0x630 [ 159.889121][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.889168][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.889214][ T114] ? __phys_addr+0xe8/0x180 [ 159.889250][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 159.889286][ T114] kasan_report+0xe0/0x110 [ 159.889327][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 159.889369][ T114] __mutex_lock+0x1a24/0x1ca0 [ 159.889407][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.889451][ T114] ? jfs_syncpt+0x2a/0xa0 [ 159.889503][ T114] ? __pfx___mutex_lock+0x10/0x10 [ 159.889543][ T114] ? do_raw_spin_lock+0x12c/0x2b0 [ 159.889598][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.889641][ T114] ? find_held_lock+0x2b/0x80 [ 159.889700][ T114] ? jfs_syncpt+0x2a/0xa0 [ 159.889744][ T114] jfs_syncpt+0x2a/0xa0 [ 159.889792][ T114] txEnd+0x30a/0x5a0 [ 159.889846][ T114] jfs_lazycommit+0x783/0xb30 [ 159.889908][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 159.889967][ T114] ? __pfx_default_wake_function+0x10/0x10 [ 159.890038][ T114] ? lockdep_hardirqs_on+0x7c/0x110 [ 159.890078][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.890126][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.890173][ T114] ? __kthread_parkme+0x19e/0x250 [ 159.890212][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 159.890270][ T114] kthread+0x3c5/0x780 [ 159.890315][ T114] ? __pfx_kthread+0x10/0x10 [ 159.890362][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.890408][ T114] ? rcu_is_watching+0x12/0xc0 [ 159.890446][ T114] ? __pfx_kthread+0x10/0x10 [ 159.890492][ T114] ret_from_fork+0x983/0xb10 [ 159.890535][ T114] ? __pfx_ret_from_fork+0x10/0x10 [ 159.890579][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 159.890625][ T114] ? __switch_to+0x7af/0x10d0 [ 159.890677][ T114] ? __pfx_kthread+0x10/0x10 [ 159.890724][ T114] ret_from_fork_asm+0x1a/0x30 [ 159.890795][ T114] [ 159.890809][ T114] [ 160.129233][ T114] Allocated by task 6161: [ 160.133555][ T114] kasan_save_stack+0x33/0x60 [ 160.138242][ T114] kasan_save_track+0x14/0x30 [ 160.142946][ T114] __kasan_kmalloc+0xaa/0xb0 [ 160.147568][ T114] lmLogOpen+0x571/0x13c0 [ 160.151924][ T114] jfs_mount_rw+0x2e9/0x6f0 [ 160.156453][ T114] jfs_fill_super+0xc46/0x1040 [ 160.161236][ T114] get_tree_bdev_flags+0x38c/0x620 [ 160.166359][ T114] vfs_get_tree+0x8e/0x330 [ 160.170803][ T114] path_mount+0x7bf/0x23a0 [ 160.175242][ T114] __x64_sys_mount+0x293/0x310 [ 160.180065][ T114] do_syscall_64+0xcd/0xf80 [ 160.184577][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.190477][ T114] [ 160.192803][ T114] Freed by task 5960: [ 160.196780][ T114] kasan_save_stack+0x33/0x60 [ 160.201464][ T114] kasan_save_track+0x14/0x30 [ 160.206157][ T114] kasan_save_free_info+0x3b/0x60 [ 160.211296][ T114] __kasan_slab_free+0x5f/0x80 [ 160.216076][ T114] kfree+0x2f8/0x6e0 [ 160.220084][ T114] lmLogClose+0x585/0x710 [ 160.224436][ T114] jfs_umount+0x2f0/0x440 [ 160.228791][ T114] jfs_put_super+0x88/0x1d0 [ 160.233299][ T114] generic_shutdown_super+0x156/0x390 [ 160.238695][ T114] kill_block_super+0x3b/0x90 [ 160.243399][ T114] deactivate_locked_super+0xc1/0x1a0 [ 160.248774][ T114] deactivate_super+0xde/0x100 [ 160.253561][ T114] cleanup_mnt+0x225/0x450 [ 160.258023][ T114] task_work_run+0x150/0x240 [ 160.262638][ T114] exit_to_user_mode_loop+0xfb/0x540 [ 160.267950][ T114] do_syscall_64+0x4ee/0xf80 [ 160.272561][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.278481][ T114] [ 160.280816][ T114] The buggy address belongs to the object at ffff888033e0b800 [ 160.280816][ T114] which belongs to the cache kmalloc-1k of size 1024 [ 160.294873][ T114] The buggy address is located 264 bytes inside of [ 160.294873][ T114] freed 1024-byte region [ffff888033e0b800, ffff888033e0bc00) [ 160.308855][ T114] [ 160.311177][ T114] The buggy address belongs to the physical page: [ 160.317577][ T114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33e08 [ 160.326344][ T114] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 160.334940][ T114] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 160.342491][ T114] page_type: f5(slab) [ 160.346488][ T114] raw: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 160.355173][ T114] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 160.363780][ T114] head: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 160.372467][ T114] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 160.381175][ T114] head: 00fff00000000003 ffffea0000cf8201 00000000ffffffff 00000000ffffffff [ 160.389864][ T114] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 160.398616][ T114] page dumped because: kasan: bad access detected [ 160.405023][ T114] page_owner tracks the page as allocated [ 160.410722][ T114] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3955, tgid 3955 (kworker/u8:13), ts 157978669437, free_ts 145201592210 [ 160.430285][ T114] post_alloc_hook+0x1af/0x220 [ 160.435165][ T114] get_page_from_freelist+0xd0b/0x31a0 [ 160.440649][ T114] __alloc_frozen_pages_noprof+0x25f/0x2430 [ 160.446572][ T114] alloc_pages_mpol+0x1fb/0x550 [ 160.451434][ T114] new_slab+0x2c3/0x430 [ 160.455606][ T114] ___slab_alloc+0xe18/0x1c90 [ 160.460558][ T114] __slab_alloc.constprop.0+0x63/0x110 [ 160.466037][ T114] __kmalloc_noprof+0x4fc/0x910 [ 160.470906][ T114] ieee802_11_parse_elems_full+0x1db/0x3780 [ 160.476942][ T114] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 [ 160.483041][ T114] ieee80211_iface_work+0xe28/0x1350 [ 160.488342][ T114] cfg80211_wiphy_work+0x3fb/0x560 [ 160.493465][ T114] process_one_work+0x9ba/0x1b20 [ 160.498417][ T114] worker_thread+0x6c8/0xf10 [ 160.503027][ T114] kthread+0x3c5/0x780 [ 160.507106][ T114] ret_from_fork+0x983/0xb10 [ 160.511706][ T114] page last free pid 6138 tgid 6138 stack trace: [ 160.518035][ T114] __free_frozen_pages+0x7df/0x1170 [ 160.523257][ T114] __put_partials+0x130/0x170 [ 160.527955][ T114] qlist_free_all+0x4c/0xf0 [ 160.532459][ T114] kasan_quarantine_reduce+0x195/0x1e0 [ 160.537923][ T114] __kasan_slab_alloc+0x69/0x90 [ 160.542782][ T114] __kmalloc_noprof+0x2f6/0x910 [ 160.547647][ T114] copy_splice_read+0x1a8/0xc20 [ 160.552512][ T114] do_splice_read+0x2bd/0x370 [ 160.557387][ T114] splice_direct_to_actor+0x2a1/0xa30 [ 160.562787][ T114] do_splice_direct+0x174/0x240 [ 160.567740][ T114] do_sendfile+0xb06/0xe50 [ 160.572161][ T114] __x64_sys_sendfile64+0x1d8/0x220 [ 160.577462][ T114] do_syscall_64+0xcd/0xf80 [ 160.581991][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.587901][ T114] [ 160.590218][ T114] Memory state around the buggy address: [ 160.595930][ T114] ffff888033e0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 160.604265][ T114] ffff888033e0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 160.612330][ T114] >ffff888033e0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 160.620391][ T114] ^ [ 160.624733][ T114] ffff888033e0b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 160.632793][ T114] ffff888033e0ba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 160.640871][ T114] ================================================================== [ 160.652512][ T114] Disabling lock debugging due to kernel taint [ 160.659944][ T114] ================================================================== [ 160.668014][ T114] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 [ 160.675878][ T114] Read of size 4 at addr ffff888033e0b8c4 by task jfsCommit/114 [ 160.683515][ T114] [ 160.685841][ T114] CPU: 0 UID: 0 PID: 114 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 160.685889][ T114] Tainted: [B]=BAD_PAGE [ 160.685902][ T114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 160.685923][ T114] Call Trace: [ 160.685934][ T114] [ 160.685946][ T114] dump_stack_lvl+0x116/0x1f0 [ 160.685984][ T114] print_report+0xcd/0x630 [ 160.686029][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.686071][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.686111][ T114] ? __phys_addr+0xe8/0x180 [ 160.686144][ T114] ? do_raw_spin_lock+0x26f/0x2b0 [ 160.686191][ T114] kasan_report+0xe0/0x110 [ 160.686230][ T114] ? do_raw_spin_lock+0x26f/0x2b0 [ 160.686282][ T114] do_raw_spin_lock+0x26f/0x2b0 [ 160.686329][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.686370][ T114] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 160.686417][ T114] ? lock_acquire+0x2cd/0x330 [ 160.686457][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 160.686495][ T114] _raw_spin_lock_irqsave+0x42/0x60 [ 160.686547][ T114] ? __mutex_lock+0xca5/0x1ca0 [ 160.686581][ T114] __mutex_lock+0xca5/0x1ca0 [ 160.686616][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.686657][ T114] ? jfs_syncpt+0x2a/0xa0 [ 160.686705][ T114] ? __pfx___mutex_lock+0x10/0x10 [ 160.686743][ T114] ? do_raw_spin_lock+0x12c/0x2b0 [ 160.686794][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.686834][ T114] ? find_held_lock+0x2b/0x80 [ 160.686889][ T114] ? jfs_syncpt+0x2a/0xa0 [ 160.686932][ T114] jfs_syncpt+0x2a/0xa0 [ 160.686976][ T114] txEnd+0x30a/0x5a0 [ 160.687028][ T114] jfs_lazycommit+0x783/0xb30 [ 160.687083][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 160.687135][ T114] ? __pfx_default_wake_function+0x10/0x10 [ 160.687191][ T114] ? lockdep_hardirqs_on+0x7c/0x110 [ 160.687223][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.687264][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.687304][ T114] ? __kthread_parkme+0x19e/0x250 [ 160.687337][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 160.687388][ T114] kthread+0x3c5/0x780 [ 160.687427][ T114] ? __pfx_kthread+0x10/0x10 [ 160.687467][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.687507][ T114] ? rcu_is_watching+0x12/0xc0 [ 160.687539][ T114] ? __pfx_kthread+0x10/0x10 [ 160.687579][ T114] ret_from_fork+0x983/0xb10 [ 160.687617][ T114] ? __pfx_ret_from_fork+0x10/0x10 [ 160.687655][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 160.687696][ T114] ? __switch_to+0x7af/0x10d0 [ 160.687740][ T114] ? __pfx_kthread+0x10/0x10 [ 160.687781][ T114] ret_from_fork_asm+0x1a/0x30 [ 160.687842][ T114] [ 160.687853][ T114] [ 160.941299][ T114] Allocated by task 6161: [ 160.945621][ T114] kasan_save_stack+0x33/0x60 [ 160.950306][ T114] kasan_save_track+0x14/0x30 [ 160.954991][ T114] __kasan_kmalloc+0xaa/0xb0 [ 160.959593][ T114] lmLogOpen+0x571/0x13c0 [ 160.963946][ T114] jfs_mount_rw+0x2e9/0x6f0 [ 160.968465][ T114] jfs_fill_super+0xc46/0x1040 [ 160.973239][ T114] get_tree_bdev_flags+0x38c/0x620 [ 160.978366][ T114] vfs_get_tree+0x8e/0x330 [ 160.982808][ T114] path_mount+0x7bf/0x23a0 [ 160.987245][ T114] __x64_sys_mount+0x293/0x310 [ 160.992049][ T114] do_syscall_64+0xcd/0xf80 [ 160.996560][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.002475][ T114] [ 161.004795][ T114] Freed by task 5960: [ 161.008766][ T114] kasan_save_stack+0x33/0x60 [ 161.013538][ T114] kasan_save_track+0x14/0x30 [ 161.018218][ T114] kasan_save_free_info+0x3b/0x60 [ 161.023267][ T114] __kasan_slab_free+0x5f/0x80 [ 161.028042][ T114] kfree+0x2f8/0x6e0 [ 161.031961][ T114] lmLogClose+0x585/0x710 [ 161.036317][ T114] jfs_umount+0x2f0/0x440 [ 161.040661][ T114] jfs_put_super+0x88/0x1d0 [ 161.045170][ T114] generic_shutdown_super+0x156/0x390 [ 161.050585][ T114] kill_block_super+0x3b/0x90 [ 161.055288][ T114] deactivate_locked_super+0xc1/0x1a0 [ 161.060666][ T114] deactivate_super+0xde/0x100 [ 161.065437][ T114] cleanup_mnt+0x225/0x450 [ 161.070127][ T114] task_work_run+0x150/0x240 [ 161.074741][ T114] exit_to_user_mode_loop+0xfb/0x540 [ 161.080570][ T114] do_syscall_64+0x4ee/0xf80 [ 161.085258][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.091158][ T114] [ 161.093474][ T114] The buggy address belongs to the object at ffff888033e0b800 [ 161.093474][ T114] which belongs to the cache kmalloc-1k of size 1024 [ 161.107621][ T114] The buggy address is located 196 bytes inside of [ 161.107621][ T114] freed 1024-byte region [ffff888033e0b800, ffff888033e0bc00) [ 161.121605][ T114] [ 161.123924][ T114] The buggy address belongs to the physical page: [ 161.130338][ T114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33e08 [ 161.139117][ T114] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 161.147661][ T114] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 161.155211][ T114] page_type: f5(slab) [ 161.159240][ T114] raw: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 161.167843][ T114] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 161.176437][ T114] head: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 161.185121][ T114] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 161.193805][ T114] head: 00fff00000000003 ffffea0000cf8201 00000000ffffffff 00000000ffffffff [ 161.202488][ T114] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 161.211158][ T114] page dumped because: kasan: bad access detected [ 161.217580][ T114] page_owner tracks the page as allocated [ 161.223299][ T114] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3955, tgid 3955 (kworker/u8:13), ts 157978669437, free_ts 145201592210 [ 161.242871][ T114] post_alloc_hook+0x1af/0x220 [ 161.247675][ T114] get_page_from_freelist+0xd0b/0x31a0 [ 161.253170][ T114] __alloc_frozen_pages_noprof+0x25f/0x2430 [ 161.259191][ T114] alloc_pages_mpol+0x1fb/0x550 [ 161.264059][ T114] new_slab+0x2c3/0x430 [ 161.268236][ T114] ___slab_alloc+0xe18/0x1c90 [ 161.273024][ T114] __slab_alloc.constprop.0+0x63/0x110 [ 161.278509][ T114] __kmalloc_noprof+0x4fc/0x910 [ 161.283382][ T114] ieee802_11_parse_elems_full+0x1db/0x3780 [ 161.289297][ T114] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 [ 161.295387][ T114] ieee80211_iface_work+0xe28/0x1350 [ 161.300699][ T114] cfg80211_wiphy_work+0x3fb/0x560 [ 161.305832][ T114] process_one_work+0x9ba/0x1b20 [ 161.310787][ T114] worker_thread+0x6c8/0xf10 [ 161.315401][ T114] kthread+0x3c5/0x780 [ 161.319476][ T114] ret_from_fork+0x983/0xb10 [ 161.324073][ T114] page last free pid 6138 tgid 6138 stack trace: [ 161.330393][ T114] __free_frozen_pages+0x7df/0x1170 [ 161.335629][ T114] __put_partials+0x130/0x170 [ 161.340357][ T114] qlist_free_all+0x4c/0xf0 [ 161.344875][ T114] kasan_quarantine_reduce+0x195/0x1e0 [ 161.350345][ T114] __kasan_slab_alloc+0x69/0x90 [ 161.355204][ T114] __kmalloc_noprof+0x2f6/0x910 [ 161.360073][ T114] copy_splice_read+0x1a8/0xc20 [ 161.364936][ T114] do_splice_read+0x2bd/0x370 [ 161.369623][ T114] splice_direct_to_actor+0x2a1/0xa30 [ 161.375008][ T114] do_splice_direct+0x174/0x240 [ 161.379875][ T114] do_sendfile+0xb06/0xe50 [ 161.384291][ T114] __x64_sys_sendfile64+0x1d8/0x220 [ 161.389589][ T114] do_syscall_64+0xcd/0xf80 [ 161.394101][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.400001][ T114] [ 161.402314][ T114] Memory state around the buggy address: [ 161.407934][ T114] ffff888033e0b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 161.415994][ T114] ffff888033e0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.424140][ T114] >ffff888033e0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.432192][ T114] ^ [ 161.438336][ T114] ffff888033e0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.446401][ T114] ffff888033e0b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 161.454721][ T114] ================================================================== [ 161.462951][ T114] ================================================================== [ 161.471011][ T114] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x27f/0x2b0 [ 161.478934][ T114] Read of size 8 at addr ffff888033e0b8d0 by task jfsCommit/114 [ 161.486563][ T114] [ 161.488890][ T114] CPU: 0 UID: 0 PID: 114 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 161.488938][ T114] Tainted: [B]=BAD_PAGE [ 161.488949][ T114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 161.488970][ T114] Call Trace: [ 161.488982][ T114] [ 161.488996][ T114] dump_stack_lvl+0x116/0x1f0 [ 161.489031][ T114] print_report+0xcd/0x630 [ 161.489069][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.489110][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.489150][ T114] ? __phys_addr+0xe8/0x180 [ 161.489183][ T114] ? do_raw_spin_lock+0x27f/0x2b0 [ 161.489229][ T114] kasan_report+0xe0/0x110 [ 161.489268][ T114] ? do_raw_spin_lock+0x27f/0x2b0 [ 161.489319][ T114] do_raw_spin_lock+0x27f/0x2b0 [ 161.489365][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.489406][ T114] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 161.489452][ T114] ? lock_acquire+0x2cd/0x330 [ 161.489491][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 161.489529][ T114] _raw_spin_lock_irqsave+0x42/0x60 [ 161.489580][ T114] ? __mutex_lock+0xca5/0x1ca0 [ 161.489613][ T114] __mutex_lock+0xca5/0x1ca0 [ 161.489648][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.489688][ T114] ? jfs_syncpt+0x2a/0xa0 [ 161.489736][ T114] ? __pfx___mutex_lock+0x10/0x10 [ 161.489777][ T114] ? do_raw_spin_lock+0x12c/0x2b0 [ 161.489827][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.489867][ T114] ? find_held_lock+0x2b/0x80 [ 161.489921][ T114] ? jfs_syncpt+0x2a/0xa0 [ 161.489963][ T114] jfs_syncpt+0x2a/0xa0 [ 161.490007][ T114] txEnd+0x30a/0x5a0 [ 161.490054][ T114] jfs_lazycommit+0x783/0xb30 [ 161.490108][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 161.490159][ T114] ? __pfx_default_wake_function+0x10/0x10 [ 161.490215][ T114] ? lockdep_hardirqs_on+0x7c/0x110 [ 161.490247][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.490287][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.490327][ T114] ? __kthread_parkme+0x19e/0x250 [ 161.490360][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 161.490410][ T114] kthread+0x3c5/0x780 [ 161.490449][ T114] ? __pfx_kthread+0x10/0x10 [ 161.490489][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.490528][ T114] ? rcu_is_watching+0x12/0xc0 [ 161.490560][ T114] ? __pfx_kthread+0x10/0x10 [ 161.490600][ T114] ret_from_fork+0x983/0xb10 [ 161.490637][ T114] ? __pfx_ret_from_fork+0x10/0x10 [ 161.490675][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 161.490714][ T114] ? __switch_to+0x7af/0x10d0 [ 161.490758][ T114] ? __pfx_kthread+0x10/0x10 [ 161.490804][ T114] ret_from_fork_asm+0x1a/0x30 [ 161.490865][ T114] [ 161.490876][ T114] [ 161.744544][ T114] Allocated by task 6161: [ 161.748877][ T114] kasan_save_stack+0x33/0x60 [ 161.753571][ T114] kasan_save_track+0x14/0x30 [ 161.758263][ T114] __kasan_kmalloc+0xaa/0xb0 [ 161.762859][ T114] lmLogOpen+0x571/0x13c0 [ 161.767207][ T114] jfs_mount_rw+0x2e9/0x6f0 [ 161.771726][ T114] jfs_fill_super+0xc46/0x1040 [ 161.776494][ T114] get_tree_bdev_flags+0x38c/0x620 [ 161.781613][ T114] vfs_get_tree+0x8e/0x330 [ 161.786051][ T114] path_mount+0x7bf/0x23a0 [ 161.790684][ T114] __x64_sys_mount+0x293/0x310 [ 161.795488][ T114] do_syscall_64+0xcd/0xf80 [ 161.799998][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.805920][ T114] [ 161.808232][ T114] Freed by task 5960: [ 161.812200][ T114] kasan_save_stack+0x33/0x60 [ 161.817157][ T114] kasan_save_track+0x14/0x30 [ 161.821836][ T114] kasan_save_free_info+0x3b/0x60 [ 161.826924][ T114] __kasan_slab_free+0x5f/0x80 [ 161.831779][ T114] kfree+0x2f8/0x6e0 [ 161.835687][ T114] lmLogClose+0x585/0x710 [ 161.840036][ T114] jfs_umount+0x2f0/0x440 [ 161.844374][ T114] jfs_put_super+0x88/0x1d0 [ 161.848886][ T114] generic_shutdown_super+0x156/0x390 [ 161.854283][ T114] kill_block_super+0x3b/0x90 [ 161.859001][ T114] deactivate_locked_super+0xc1/0x1a0 [ 161.864409][ T114] deactivate_super+0xde/0x100 [ 161.869183][ T114] cleanup_mnt+0x225/0x450 [ 161.873612][ T114] task_work_run+0x150/0x240 [ 161.878218][ T114] exit_to_user_mode_loop+0xfb/0x540 [ 161.883610][ T114] do_syscall_64+0x4ee/0xf80 [ 161.888205][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.894112][ T114] [ 161.896426][ T114] The buggy address belongs to the object at ffff888033e0b800 [ 161.896426][ T114] which belongs to the cache kmalloc-1k of size 1024 [ 161.910488][ T114] The buggy address is located 208 bytes inside of [ 161.910488][ T114] freed 1024-byte region [ffff888033e0b800, ffff888033e0bc00) [ 161.924463][ T114] [ 161.926781][ T114] The buggy address belongs to the physical page: [ 161.933180][ T114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33e08 [ 161.941943][ T114] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 161.950450][ T114] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 161.958011][ T114] page_type: f5(slab) [ 161.962006][ T114] raw: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 161.970613][ T114] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 161.979307][ T114] head: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 161.988000][ T114] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 161.996681][ T114] head: 00fff00000000003 ffffea0000cf8201 00000000ffffffff 00000000ffffffff [ 162.005396][ T114] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 162.014062][ T114] page dumped because: kasan: bad access detected [ 162.020471][ T114] page_owner tracks the page as allocated [ 162.026181][ T114] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3955, tgid 3955 (kworker/u8:13), ts 157978669437, free_ts 145201592210 [ 162.045739][ T114] post_alloc_hook+0x1af/0x220 [ 162.050629][ T114] get_page_from_freelist+0xd0b/0x31a0 [ 162.056127][ T114] __alloc_frozen_pages_noprof+0x25f/0x2430 [ 162.062055][ T114] alloc_pages_mpol+0x1fb/0x550 [ 162.066925][ T114] new_slab+0x2c3/0x430 [ 162.071187][ T114] ___slab_alloc+0xe18/0x1c90 [ 162.075880][ T114] __slab_alloc.constprop.0+0x63/0x110 [ 162.081376][ T114] __kmalloc_noprof+0x4fc/0x910 [ 162.086251][ T114] ieee802_11_parse_elems_full+0x1db/0x3780 [ 162.092256][ T114] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 [ 162.098429][ T114] ieee80211_iface_work+0xe28/0x1350 [ 162.103732][ T114] cfg80211_wiphy_work+0x3fb/0x560 [ 162.108853][ T114] process_one_work+0x9ba/0x1b20 [ 162.113810][ T114] worker_thread+0x6c8/0xf10 [ 162.118413][ T114] kthread+0x3c5/0x780 [ 162.122490][ T114] ret_from_fork+0x983/0xb10 [ 162.127090][ T114] page last free pid 6138 tgid 6138 stack trace: [ 162.133407][ T114] __free_frozen_pages+0x7df/0x1170 [ 162.138622][ T114] __put_partials+0x130/0x170 [ 162.143316][ T114] qlist_free_all+0x4c/0xf0 [ 162.147820][ T114] kasan_quarantine_reduce+0x195/0x1e0 [ 162.153287][ T114] __kasan_slab_alloc+0x69/0x90 [ 162.158142][ T114] __kmalloc_noprof+0x2f6/0x910 [ 162.163014][ T114] copy_splice_read+0x1a8/0xc20 [ 162.167883][ T114] do_splice_read+0x2bd/0x370 [ 162.172572][ T114] splice_direct_to_actor+0x2a1/0xa30 [ 162.177966][ T114] do_splice_direct+0x174/0x240 [ 162.182830][ T114] do_sendfile+0xb06/0xe50 [ 162.187248][ T114] __x64_sys_sendfile64+0x1d8/0x220 [ 162.192464][ T114] do_syscall_64+0xcd/0xf80 [ 162.196998][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.202916][ T114] [ 162.205234][ T114] Memory state around the buggy address: [ 162.210856][ T114] ffff888033e0b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 162.219003][ T114] ffff888033e0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.227174][ T114] >ffff888033e0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.235234][ T114] ^ [ 162.241933][ T114] ffff888033e0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.250011][ T114] ffff888033e0b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.258164][ T114] ================================================================== [ 162.266227][ T114] ================================================================== [ 162.274294][ T114] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x265/0x2b0 [ 162.282136][ T114] Read of size 4 at addr ffff888033e0b8c8 by task jfsCommit/114 [ 162.289775][ T114] [ 162.292122][ T114] CPU: 0 UID: 0 PID: 114 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 162.292170][ T114] Tainted: [B]=BAD_PAGE [ 162.292182][ T114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 162.292203][ T114] Call Trace: [ 162.292215][ T114] [ 162.292228][ T114] dump_stack_lvl+0x116/0x1f0 [ 162.292264][ T114] print_report+0xcd/0x630 [ 162.292302][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.292343][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.292383][ T114] ? __phys_addr+0xe8/0x180 [ 162.292416][ T114] ? do_raw_spin_lock+0x265/0x2b0 [ 162.292463][ T114] kasan_report+0xe0/0x110 [ 162.292502][ T114] ? do_raw_spin_lock+0x265/0x2b0 [ 162.292553][ T114] do_raw_spin_lock+0x265/0x2b0 [ 162.292599][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.292640][ T114] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 162.292686][ T114] ? lock_acquire+0x2cd/0x330 [ 162.292725][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 162.292763][ T114] _raw_spin_lock_irqsave+0x42/0x60 [ 162.292819][ T114] ? __mutex_lock+0xca5/0x1ca0 [ 162.292853][ T114] __mutex_lock+0xca5/0x1ca0 [ 162.292887][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.292928][ T114] ? jfs_syncpt+0x2a/0xa0 [ 162.292976][ T114] ? __pfx___mutex_lock+0x10/0x10 [ 162.293013][ T114] ? do_raw_spin_lock+0x12c/0x2b0 [ 162.293064][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.293103][ T114] ? find_held_lock+0x2b/0x80 [ 162.293158][ T114] ? jfs_syncpt+0x2a/0xa0 [ 162.293200][ T114] jfs_syncpt+0x2a/0xa0 [ 162.293244][ T114] txEnd+0x30a/0x5a0 [ 162.293291][ T114] jfs_lazycommit+0x783/0xb30 [ 162.293345][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 162.293396][ T114] ? __pfx_default_wake_function+0x10/0x10 [ 162.293452][ T114] ? lockdep_hardirqs_on+0x7c/0x110 [ 162.293483][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.293524][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.293564][ T114] ? __kthread_parkme+0x19e/0x250 [ 162.293597][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 162.293646][ T114] kthread+0x3c5/0x780 [ 162.293685][ T114] ? __pfx_kthread+0x10/0x10 [ 162.293725][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.293764][ T114] ? rcu_is_watching+0x12/0xc0 [ 162.293796][ T114] ? __pfx_kthread+0x10/0x10 [ 162.293840][ T114] ret_from_fork+0x983/0xb10 [ 162.293877][ T114] ? __pfx_ret_from_fork+0x10/0x10 [ 162.293915][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 162.293955][ T114] ? __switch_to+0x7af/0x10d0 [ 162.293998][ T114] ? __pfx_kthread+0x10/0x10 [ 162.294038][ T114] ret_from_fork_asm+0x1a/0x30 [ 162.294099][ T114] [ 162.294110][ T114] [ 162.547835][ T114] Allocated by task 6161: [ 162.552245][ T114] kasan_save_stack+0x33/0x60 [ 162.556929][ T114] kasan_save_track+0x14/0x30 [ 162.561613][ T114] __kasan_kmalloc+0xaa/0xb0 [ 162.566202][ T114] lmLogOpen+0x571/0x13c0 [ 162.570550][ T114] jfs_mount_rw+0x2e9/0x6f0 [ 162.575062][ T114] jfs_fill_super+0xc46/0x1040 [ 162.579835][ T114] get_tree_bdev_flags+0x38c/0x620 [ 162.584970][ T114] vfs_get_tree+0x8e/0x330 [ 162.589453][ T114] path_mount+0x7bf/0x23a0 [ 162.593917][ T114] __x64_sys_mount+0x293/0x310 [ 162.598702][ T114] do_syscall_64+0xcd/0xf80 [ 162.603211][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.609126][ T114] [ 162.611876][ T114] Freed by task 5960: [ 162.615844][ T114] kasan_save_stack+0x33/0x60 [ 162.620532][ T114] kasan_save_track+0x14/0x30 [ 162.625216][ T114] kasan_save_free_info+0x3b/0x60 [ 162.630263][ T114] __kasan_slab_free+0x5f/0x80 [ 162.635044][ T114] kfree+0x2f8/0x6e0 [ 162.638957][ T114] lmLogClose+0x585/0x710 [ 162.643312][ T114] jfs_umount+0x2f0/0x440 [ 162.647660][ T114] jfs_put_super+0x88/0x1d0 [ 162.652169][ T114] generic_shutdown_super+0x156/0x390 [ 162.657563][ T114] kill_block_super+0x3b/0x90 [ 162.662265][ T114] deactivate_locked_super+0xc1/0x1a0 [ 162.667639][ T114] deactivate_super+0xde/0x100 [ 162.672407][ T114] cleanup_mnt+0x225/0x450 [ 162.676835][ T114] task_work_run+0x150/0x240 [ 162.681438][ T114] exit_to_user_mode_loop+0xfb/0x540 [ 162.686738][ T114] do_syscall_64+0x4ee/0xf80 [ 162.691333][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.697231][ T114] [ 162.699550][ T114] The buggy address belongs to the object at ffff888033e0b800 [ 162.699550][ T114] which belongs to the cache kmalloc-1k of size 1024 [ 162.713608][ T114] The buggy address is located 200 bytes inside of [ 162.713608][ T114] freed 1024-byte region [ffff888033e0b800, ffff888033e0bc00) [ 162.727506][ T114] [ 162.729828][ T114] The buggy address belongs to the physical page: [ 162.736232][ T114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33e08 [ 162.744994][ T114] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 162.753494][ T114] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 162.761044][ T114] page_type: f5(slab) [ 162.765031][ T114] raw: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 162.773619][ T114] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 162.782210][ T114] head: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 162.790886][ T114] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 162.799822][ T114] head: 00fff00000000003 ffffea0000cf8201 00000000ffffffff 00000000ffffffff [ 162.808494][ T114] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 162.817158][ T114] page dumped because: kasan: bad access detected [ 162.823566][ T114] page_owner tracks the page as allocated [ 162.829271][ T114] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3955, tgid 3955 (kworker/u8:13), ts 157978669437, free_ts 145201592210 [ 162.848828][ T114] post_alloc_hook+0x1af/0x220 [ 162.853617][ T114] get_page_from_freelist+0xd0b/0x31a0 [ 162.859134][ T114] __alloc_frozen_pages_noprof+0x25f/0x2430 [ 162.865160][ T114] alloc_pages_mpol+0x1fb/0x550 [ 162.870031][ T114] new_slab+0x2c3/0x430 [ 162.874205][ T114] ___slab_alloc+0xe18/0x1c90 [ 162.878898][ T114] __slab_alloc.constprop.0+0x63/0x110 [ 162.884379][ T114] __kmalloc_noprof+0x4fc/0x910 [ 162.889343][ T114] ieee802_11_parse_elems_full+0x1db/0x3780 [ 162.895277][ T114] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 [ 162.901379][ T114] ieee80211_iface_work+0xe28/0x1350 [ 162.906774][ T114] cfg80211_wiphy_work+0x3fb/0x560 [ 162.911994][ T114] process_one_work+0x9ba/0x1b20 [ 162.916963][ T114] worker_thread+0x6c8/0xf10 [ 162.921580][ T114] kthread+0x3c5/0x780 [ 162.925672][ T114] ret_from_fork+0x983/0xb10 [ 162.930296][ T114] page last free pid 6138 tgid 6138 stack trace: [ 162.936626][ T114] __free_frozen_pages+0x7df/0x1170 [ 162.941840][ T114] __put_partials+0x130/0x170 [ 162.946538][ T114] qlist_free_all+0x4c/0xf0 [ 162.951219][ T114] kasan_quarantine_reduce+0x195/0x1e0 [ 162.956680][ T114] __kasan_slab_alloc+0x69/0x90 [ 162.961545][ T114] __kmalloc_noprof+0x2f6/0x910 [ 162.966416][ T114] copy_splice_read+0x1a8/0xc20 [ 162.971282][ T114] do_splice_read+0x2bd/0x370 [ 162.975979][ T114] splice_direct_to_actor+0x2a1/0xa30 [ 162.981363][ T114] do_splice_direct+0x174/0x240 [ 162.986230][ T114] do_sendfile+0xb06/0xe50 [ 162.990662][ T114] __x64_sys_sendfile64+0x1d8/0x220 [ 162.995881][ T114] do_syscall_64+0xcd/0xf80 [ 163.000389][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.006463][ T114] [ 163.008777][ T114] Memory state around the buggy address: [ 163.014401][ T114] ffff888033e0b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 163.022463][ T114] ffff888033e0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.030528][ T114] >ffff888033e0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.038584][ T114] ^ [ 163.044994][ T114] ffff888033e0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.053057][ T114] ffff888033e0b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.061136][ T114] ================================================================== [ 163.069293][ T114] ================================================================== [ 163.077349][ T114] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x11d/0x2b0 [ 163.085182][ T114] Write of size 4 at addr ffff888033e0b8c0 by task jfsCommit/114 [ 163.092990][ T114] [ 163.095320][ T114] CPU: 0 UID: 0 PID: 114 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 163.095368][ T114] Tainted: [B]=BAD_PAGE [ 163.095380][ T114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 163.095401][ T114] Call Trace: [ 163.095412][ T114] [ 163.095424][ T114] dump_stack_lvl+0x116/0x1f0 [ 163.095461][ T114] print_report+0xcd/0x630 [ 163.095499][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.095540][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.095580][ T114] ? __phys_addr+0xe8/0x180 [ 163.095613][ T114] ? do_raw_spin_lock+0x11d/0x2b0 [ 163.095660][ T114] kasan_report+0xe0/0x110 [ 163.095699][ T114] ? do_raw_spin_lock+0x11d/0x2b0 [ 163.095751][ T114] kasan_check_range+0x100/0x1b0 [ 163.095798][ T114] do_raw_spin_lock+0x11d/0x2b0 [ 163.095844][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.095886][ T114] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 163.095935][ T114] ? lock_acquire+0x2cd/0x330 [ 163.095981][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 163.096020][ T114] _raw_spin_lock_irqsave+0x42/0x60 [ 163.096071][ T114] ? __mutex_lock+0xca5/0x1ca0 [ 163.096105][ T114] __mutex_lock+0xca5/0x1ca0 [ 163.096141][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.096182][ T114] ? jfs_syncpt+0x2a/0xa0 [ 163.096230][ T114] ? __pfx___mutex_lock+0x10/0x10 [ 163.096268][ T114] ? do_raw_spin_lock+0x12c/0x2b0 [ 163.096318][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.096358][ T114] ? find_held_lock+0x2b/0x80 [ 163.096413][ T114] ? jfs_syncpt+0x2a/0xa0 [ 163.096455][ T114] jfs_syncpt+0x2a/0xa0 [ 163.096500][ T114] txEnd+0x30a/0x5a0 [ 163.096547][ T114] jfs_lazycommit+0x783/0xb30 [ 163.096601][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 163.096653][ T114] ? __pfx_default_wake_function+0x10/0x10 [ 163.096709][ T114] ? lockdep_hardirqs_on+0x7c/0x110 [ 163.096741][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.096782][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.096822][ T114] ? __kthread_parkme+0x19e/0x250 [ 163.096855][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 163.096905][ T114] kthread+0x3c5/0x780 [ 163.096944][ T114] ? __pfx_kthread+0x10/0x10 [ 163.096989][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.097030][ T114] ? rcu_is_watching+0x12/0xc0 [ 163.097062][ T114] ? __pfx_kthread+0x10/0x10 [ 163.097102][ T114] ret_from_fork+0x983/0xb10 [ 163.097139][ T114] ? __pfx_ret_from_fork+0x10/0x10 [ 163.097177][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.097218][ T114] ? __switch_to+0x7af/0x10d0 [ 163.097262][ T114] ? __pfx_kthread+0x10/0x10 [ 163.097302][ T114] ret_from_fork_asm+0x1a/0x30 [ 163.097363][ T114] [ 163.097375][ T114] [ 163.355285][ T114] Allocated by task 6161: [ 163.359605][ T114] kasan_save_stack+0x33/0x60 [ 163.364385][ T114] kasan_save_track+0x14/0x30 [ 163.369064][ T114] __kasan_kmalloc+0xaa/0xb0 [ 163.373659][ T114] lmLogOpen+0x571/0x13c0 [ 163.378012][ T114] jfs_mount_rw+0x2e9/0x6f0 [ 163.382534][ T114] jfs_fill_super+0xc46/0x1040 [ 163.387296][ T114] get_tree_bdev_flags+0x38c/0x620 [ 163.392429][ T114] vfs_get_tree+0x8e/0x330 [ 163.396872][ T114] path_mount+0x7bf/0x23a0 [ 163.401394][ T114] __x64_sys_mount+0x293/0x310 [ 163.406175][ T114] do_syscall_64+0xcd/0xf80 [ 163.410679][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.416574][ T114] [ 163.418893][ T114] Freed by task 5960: [ 163.422864][ T114] kasan_save_stack+0x33/0x60 [ 163.427546][ T114] kasan_save_track+0x14/0x30 [ 163.432314][ T114] kasan_save_free_info+0x3b/0x60 [ 163.437356][ T114] __kasan_slab_free+0x5f/0x80 [ 163.442124][ T114] kfree+0x2f8/0x6e0 [ 163.446037][ T114] lmLogClose+0x585/0x710 [ 163.450380][ T114] jfs_umount+0x2f0/0x440 [ 163.454724][ T114] jfs_put_super+0x88/0x1d0 [ 163.459223][ T114] generic_shutdown_super+0x156/0x390 [ 163.464718][ T114] kill_block_super+0x3b/0x90 [ 163.469421][ T114] deactivate_locked_super+0xc1/0x1a0 [ 163.474796][ T114] deactivate_super+0xde/0x100 [ 163.479567][ T114] cleanup_mnt+0x225/0x450 [ 163.483993][ T114] task_work_run+0x150/0x240 [ 163.488595][ T114] exit_to_user_mode_loop+0xfb/0x540 [ 163.493986][ T114] do_syscall_64+0x4ee/0xf80 [ 163.498580][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.504488][ T114] [ 163.506801][ T114] The buggy address belongs to the object at ffff888033e0b800 [ 163.506801][ T114] which belongs to the cache kmalloc-1k of size 1024 [ 163.520969][ T114] The buggy address is located 192 bytes inside of [ 163.520969][ T114] freed 1024-byte region [ffff888033e0b800, ffff888033e0bc00) [ 163.534858][ T114] [ 163.537177][ T114] The buggy address belongs to the physical page: [ 163.543575][ T114] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33e08 [ 163.552335][ T114] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 163.560836][ T114] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 163.568555][ T114] page_type: f5(slab) [ 163.572540][ T114] raw: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 163.581130][ T114] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 163.589717][ T114] head: 00fff00000000040 ffff88813ff26dc0 dead000000000122 0000000000000000 [ 163.598391][ T114] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 163.607069][ T114] head: 00fff00000000003 ffffea0000cf8201 00000000ffffffff 00000000ffffffff [ 163.615740][ T114] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 163.624402][ T114] page dumped because: kasan: bad access detected [ 163.630810][ T114] page_owner tracks the page as allocated [ 163.636513][ T114] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 3955, tgid 3955 (kworker/u8:13), ts 157978669437, free_ts 145201592210 [ 163.656155][ T114] post_alloc_hook+0x1af/0x220 [ 163.660945][ T114] get_page_from_freelist+0xd0b/0x31a0 [ 163.666435][ T114] __alloc_frozen_pages_noprof+0x25f/0x2430 [ 163.672352][ T114] alloc_pages_mpol+0x1fb/0x550 [ 163.677214][ T114] new_slab+0x2c3/0x430 [ 163.681410][ T114] ___slab_alloc+0xe18/0x1c90 [ 163.686215][ T114] __slab_alloc.constprop.0+0x63/0x110 [ 163.691911][ T114] __kmalloc_noprof+0x4fc/0x910 [ 163.696798][ T114] ieee802_11_parse_elems_full+0x1db/0x3780 [ 163.702720][ T114] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 [ 163.708811][ T114] ieee80211_iface_work+0xe28/0x1350 [ 163.714121][ T114] cfg80211_wiphy_work+0x3fb/0x560 [ 163.719241][ T114] process_one_work+0x9ba/0x1b20 [ 163.724201][ T114] worker_thread+0x6c8/0xf10 [ 163.728808][ T114] kthread+0x3c5/0x780 [ 163.732981][ T114] ret_from_fork+0x983/0xb10 [ 163.737592][ T114] page last free pid 6138 tgid 6138 stack trace: [ 163.744001][ T114] __free_frozen_pages+0x7df/0x1170 [ 163.749657][ T114] __put_partials+0x130/0x170 [ 163.754356][ T114] qlist_free_all+0x4c/0xf0 [ 163.758865][ T114] kasan_quarantine_reduce+0x195/0x1e0 [ 163.764326][ T114] __kasan_slab_alloc+0x69/0x90 [ 163.769187][ T114] __kmalloc_noprof+0x2f6/0x910 [ 163.774054][ T114] copy_splice_read+0x1a8/0xc20 [ 163.779004][ T114] do_splice_read+0x2bd/0x370 [ 163.783696][ T114] splice_direct_to_actor+0x2a1/0xa30 [ 163.789083][ T114] do_splice_direct+0x174/0x240 [ 163.793956][ T114] do_sendfile+0xb06/0xe50 [ 163.798391][ T114] __x64_sys_sendfile64+0x1d8/0x220 [ 163.803611][ T114] do_syscall_64+0xcd/0xf80 [ 163.808120][ T114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.814023][ T114] [ 163.816448][ T114] Memory state around the buggy address: [ 163.822072][ T114] ffff888033e0b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 163.830128][ T114] ffff888033e0b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.838194][ T114] >ffff888033e0b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.846253][ T114] ^ [ 163.852401][ T114] ffff888033e0b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.860472][ T114] ffff888033e0b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 163.868524][ T114] ================================================================== [ 163.876580][ T114] Kernel panic - not syncing: kasan.fault=panic_on_write set ... [ 163.884297][ T114] CPU: 0 UID: 0 PID: 114 Comm: jfsCommit Tainted: G B syzkaller #0 PREEMPT(full) [ 163.895030][ T114] Tainted: [B]=BAD_PAGE [ 163.899178][ T114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 163.909237][ T114] Call Trace: [ 163.912513][ T114] [ 163.915442][ T114] dump_stack_lvl+0x3d/0x1f0 [ 163.920044][ T114] vpanic+0x640/0x6f0 [ 163.924046][ T114] panic+0xca/0xd0 [ 163.927788][ T114] ? __pfx_panic+0x10/0x10 [ 163.932216][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.937863][ T114] ? rcu_is_watching+0x12/0xc0 [ 163.942632][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.948277][ T114] ? lock_release+0x201/0x2d0 [ 163.952968][ T114] ? print_report+0x2bd/0x630 [ 163.957660][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.963316][ T114] end_report+0x13f/0x160 [ 163.967689][ T114] kasan_report+0xee/0x110 [ 163.972120][ T114] ? do_raw_spin_lock+0x11d/0x2b0 [ 163.977205][ T114] kasan_check_range+0x100/0x1b0 [ 163.982178][ T114] do_raw_spin_lock+0x11d/0x2b0 [ 163.987054][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 163.992708][ T114] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 163.998099][ T114] ? lock_acquire+0x2cd/0x330 [ 164.002912][ T114] ? __mutex_lock+0x1a24/0x1ca0 [ 164.007946][ T114] _raw_spin_lock_irqsave+0x42/0x60 [ 164.013185][ T114] ? __mutex_lock+0xca5/0x1ca0 [ 164.017962][ T114] __mutex_lock+0xca5/0x1ca0 [ 164.022571][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.028222][ T114] ? jfs_syncpt+0x2a/0xa0 [ 164.032575][ T114] ? __pfx___mutex_lock+0x10/0x10 [ 164.037611][ T114] ? do_raw_spin_lock+0x12c/0x2b0 [ 164.042660][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.048311][ T114] ? find_held_lock+0x2b/0x80 [ 164.053117][ T114] ? jfs_syncpt+0x2a/0xa0 [ 164.057464][ T114] jfs_syncpt+0x2a/0xa0 [ 164.061645][ T114] txEnd+0x30a/0x5a0 [ 164.065566][ T114] jfs_lazycommit+0x783/0xb30 [ 164.070282][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 164.075595][ T114] ? __pfx_default_wake_function+0x10/0x10 [ 164.081428][ T114] ? lockdep_hardirqs_on+0x7c/0x110 [ 164.086633][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.092279][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.097925][ T114] ? __kthread_parkme+0x19e/0x250 [ 164.102958][ T114] ? __pfx_jfs_lazycommit+0x10/0x10 [ 164.108179][ T114] kthread+0x3c5/0x780 [ 164.112264][ T114] ? __pfx_kthread+0x10/0x10 [ 164.116870][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.122604][ T114] ? rcu_is_watching+0x12/0xc0 [ 164.127374][ T114] ? __pfx_kthread+0x10/0x10 [ 164.131982][ T114] ret_from_fork+0x983/0xb10 [ 164.136586][ T114] ? __pfx_ret_from_fork+0x10/0x10 [ 164.141709][ T114] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.147357][ T114] ? __switch_to+0x7af/0x10d0 [ 164.152068][ T114] ? __pfx_kthread+0x10/0x10 [ 164.156670][ T114] ret_from_fork_asm+0x1a/0x30 [ 164.161471][ T114] [ 164.164790][ T114] Kernel Offset: disabled [ 164.169108][ T114] Rebooting in 86400 seconds..